Two ways to establish a connection

HTTP CONNECT asks a proxy to establish a tunnel to a destination. SOCKS5 uses a separate protocol for negotiating proxy connections. The relevant RFCs define their behavior; neither name is a promise of anonymity. Use the protocol specified by your provider rather than guessing from the port number.

Configure and test before browsing

Mac Profiles supports HTTP CONNECT and SOCKS5 settings with separate host, port and credential fields. Local proxy passwords are held in Keychain. A successful connection check can show the proxy's exit IP and country estimate, with an explicit action to copy the IP. An old successful result should not be treated as current after a later check fails.

A failed proxy must be tested too

Our owned fixtures exercise working routes, authentication failures, stopped proxies and prohibited direct destinations. Those tests look for received network traffic as well as browser errors. A page reporting a failure is useful evidence, but it does not by itself show where every attempted request went.

The current WebKit boundary

Protected startup currently depends on a version-specific policy for macOS 26.5 build 25F71 with WebKit 21624.2.5.11.4. Unsupported combinations are blocked before navigation. The policy restricts capabilities such as WebRTC and service workers; it is not a system-wide firewall. The tested cases do not constitute proof against every possible DNS, transport or future WebKit behavior.

Keep the route explicit

A direct profile uses your Mac's ordinary connection. A protected proxy profile should never silently become a direct profile because setup failed. When changing a running profile's connection, close it through the normal save process and reopen it with the new settings. Keep the observed exit, test time and any relevant failure in your workflow notes, without copying the proxy password there.